Liquid Network Bitcoin Sidechain Hack Nets Attackers $47M After Partial Refund

A critical vulnerability in Blockstream's Liquid Network, a Bitcoin sidechain designed for fast, private transactions, allowed attackers to drain nearly 4,000 BTC (worth $320 million at the time) from the network's reserve wallet on September 6. The exploit targeted a flaw in the caching mechanism behind Liquid's Confidential Transactions system, which normally uses cryptographic proofs to validate transfers while hiding amounts. This flaw let attackers create unbacked L-BTC tokens and swap them for real BTC, draining about 95% of Liquid's federation wallet before the network was paused.

The attackers, claiming to be white-hat hackers, contacted Blockstream through Bitcoin's OP_RETURN field and promised to return the funds once the vulnerability was patched. Blockstream confirmed a fix on September 7, and the attackers returned 3,400 BTC but kept roughly 600 BTC (about $47 million), with no clarity yet on whether this represents a bounty or ongoing negotiation. As of September 9, Liquid Network remains paused pending further security measures.

The incident underscores that while Bitcoin's core protocol remained unaffected, secondary infrastructure such as sidechains, bridges, and custodial platforms can introduce serious new attack surfaces. Bitcoin's price was largely unaffected by the news, reflecting the isolated nature of the breach.